The first question any careful owner asks about putting a large language model on the public internet is the right one: what happens when someone scripts it? Every answer a model produces costs real money, and an unprotected endpoint is an invitation to spend yours.
We run several public GenAI demos on Amazon Bedrock: a retrieval-augmented assistant, a workbench that fans one prompt out to four foundation models, and a document-intelligence pipeline. Strangers use them every day. The reason we sleep fine is that the worst-case daily spend for each one was a number we computed before launch, and the architecture makes that number a ceiling, not an estimate.
The failure mode is unbounded multiplication
A GenAI bill blows up when three things multiply without limits: how many requests a caller can make, how much input they control, and how much output the model may produce. Cap all three and the product cannot exceed the ceiling no matter who shows up. Leave any one uncapped and the others do not save you.
The guardrail stack
- No published credentials for anything that burns tokens. Demos that cost money per request do not print a sign-in on the page, and self-signup is disabled. A leaked credential is still bounded by the caps below.
- Hard daily counters, enforced in the database. Every request decrements per-user and global daily budgets held as conditional writes in DynamoDB. When the day's budget is gone the request is refused politely before any model is invoked. There is no race where two simultaneous callers both sneak past the limit; the database refuses the second one.
- A visitor tier that never forwards visitor text. Anonymous users get a curated library of questions to choose from. The chosen question's ID travels to the backend; whatever a visitor typed does not reach the model at all. Curiosity gets a real answer, prompt injection gets nothing to inject into.
- Output ceilings. Visitor-tier answers are capped at 300 output tokens. The model cannot be talked into writing a novel on our account.
- Edge limits in front of everything. API throttles hold each demo to a few requests per second, and a shared web application firewall rate-limits by IP across all of our sites. Most abusive traffic never reaches the application.
- Budgets as the backstop. Account-level AWS Budgets alert the same day anything drifts, which in this design should never be the first signal.
The discipline in one sentence: before launch, multiply every cap by the ceiling price of one request, write the resulting worst-case number down, and only ship when you would happily pay it every day. Ours works out to a few dollars per demo on the worst imaginable day, and normal days round to pennies.
The same math protects internal tools
This is not just demo hygiene. The pattern transfers directly to production GenAI: per-team and per-application daily budgets in the data layer, curated prompt surfaces for anything unauthenticated, output token ceilings matched to the use case, and alarms that fire on the first strange hour rather than the monthly invoice. Bedrock makes the per-request price knowable in advance, which means the worst case is computable, which means it can be engineered instead of feared.
If your team is holding back a GenAI rollout because finance cannot get a straight answer on exposure, that is a solvable engineering problem. Our AI on AWS practice builds these guardrails as standard equipment, and our AI training teaches your own engineers the same discipline.
Want the worst-case number for a system you are planning? Email info@planetek.org or book a free consultation. More notes live on the Insights page.